Merge: tcp: Correct signedness in skb remaining space calculation

MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-10/-/merge_requests/326

JIRA: https://issues.redhat.com/browse/RHEL-107843
CVE: CVE-2025-38463

commit d3a5f28
Author: Jiayuan Chen <[email protected]>
Date:   Mon Jul 7 13:41:11 2025 +0800

    tcp: Correct signedness in skb remaining space calculation

    Syzkaller reported a bug [1] where sk->sk_forward_alloc can overflow.

    When we send data, if an skb exists at the tail of the write queue, the
    kernel will attempt to append the new data to that skb. However, the code
    that checks for available space in the skb is flawed:
    '''
    copy = size_goal - skb->len
    '''

    The types of the variables involved are:
    '''
    copy: ssize_t (s64 on 64-bit systems)
    size_goal: int
    skb->len: unsigned int
    '''

    Due to C's type promotion rules, the signed size_goal is converted to an
    unsigned int to match skb->len before the subtraction. The result is an
    unsigned int.

    When this unsigned int result is then assigned to the s64 copy variable,
    it is zero-extended, preserving its non-negative value. Consequently, copy
    is always >= 0.

    Assume we are sending 2GB of data and size_goal has been adjusted to a
    value smaller than skb->len. The subtraction will result in copy holding a
    very large positive integer. In the subsequent logic, this large value is
    used to update sk->sk_forward_alloc, which can easily cause it to overflow.

    The syzkaller reproducer uses TCP_REPAIR to reliably create this
    condition. However, this can also occur in real-world scenarios. The
    tcp_bound_to_half_wnd() function can also reduce size_goal to a small
    value. This would cause the subsequent tcp_wmem_schedule() to set
    sk->sk_forward_alloc to a value close to INT_MAX. Further memory
    allocation requests would then cause sk_forward_alloc to wrap around and
    become negative.

    [1]: https://syzkaller.appspot.com/bug?extid=de6565462ab540f50e47

    Reported-by: [email protected]
    Fixes: 270a1c3 ("tcp: Support MSG_SPLICE_PAGES")
    Signed-off-by: Jiayuan Chen <[email protected]>
    Reviewed-by: Eric Dumazet <[email protected]>
    Reviewed-by: David Howells <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>

Signed-off-by: Florian Westphal <[email protected]>

Closes RHEL-107843

Approved-by: Antoine Tenart <[email protected]>
Approved-by: Guillaume Nault <[email protected]>
Approved-by: Murphy Zhou <[email protected]>
Approved-by: CKI KWF Bot <[email protected]>

Merged-by: Jan Stancek <[email protected]>

Author: jstancek

net/ipv4/tcp.c

@@ -1150,7 +1150,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
 		goto do_error;
 
 	while (msg_data_left(msg)) {
-		ssize_t copy = 0;
+		int copy = 0;
 
 		skb = tcp_write_queue_tail(sk);
 		if (skb)